THI02-J
4.3THI02-J. Do not invoke Thread.run()
It is critical to ensure that threads are started correctly. Thread start-up can be misleading because sometimes the code appears to be performing the function correctly, when it is actually executing in the wrong thread.
The Thread.start() method starts executing a thread’s run() method in the respective thread. It is a mistake to directly invoke the run() method on a Thread object. When invoked directly, the statements in the run() method execute in the current thread instead of the newly created thread. Furthermore, if the Thread object is not constructed from a Runnable object but rather by instantiating a subclass of Thread that does not override the run() method, a call to the subclass’s run() method invokes Thread.run(), which does nothing.
4.3.1Noncompliant Code Example
This noncompliant code example explicitly invokes the run() method in the context of the current thread.
public final class Foo implements Runnable { @Override public void run() {
// ...
}
public static void main(String[] args) { Foo foo = new Foo();
new Thread(foo).run();
}
}
The start() method is not invoked on the new thread because of the incorrect assumption that run() starts the new thread. Consequently, the statements in the run() method execute in the same thread instead of the new one.
4.3.2Compliant Solution
This compliant solution correctly uses the start() method to start a new thread. Then, that method internally invokes the run() method in the new thread.
public final class Foo implements Runnable { @Override public void run() {
// ...
}
public static void main(String[] args) { Foo foo = new Foo();
new Thread(foo).start();
}
}
CMU/SEI-2010-TR-015 | 99
THI02-J
4.3.3Exceptions
THI02-EX1: The run() method may be invoked when unit testing functionality. Note that this method cannot be used to test a class for multithreaded use.
Given a Thread object that has been constructed with a runnable argument, when invoking the Thread.run()method, the Thread object may be cast to Runnable to eliminate analyzer diagnostics.
Thread thread = new Thread(new Runnable() { @Override public void run() {
// ...
}
});
((Runnable) thread).run(); // Exception: This does not start a new thread
Casting a thread to Runnable before calling the run() method documents that the explicit call to Thread.run() is intentional. Adding an explanatory comment alongside the invocation is highly recommended.
4.3.4Risk Assessment
Failing to start threads correctly can cause unexpected behavior.
Guideline |
Severity |
Likelihood |
Remediation Cost |
Priority |
Level |
THI02- J |
low |
probable |
medium |
P4 |
L3 |
4.3.5References
[Sun 2009b] |
Interface Runnable and class Thread |
CMU/SEI-2010-TR-015 | 100
THI03-J
4.4THI03-J. Always invoke wait() and await() methods inside a loop
The Object.wait() method temporarily cedes possession of a lock so that another thread that is requesting the lock can proceed. Object.wait() must always be called from a synchronized block or method. To resume the waiting thread, the requesting thread must invoke the notify() method to notify it. Furthermore, the wait() method should be invoked in a loop that checks if a condition predicate holds. Note that a condition predicate is the negation of the condition expression in the loop. For example, the condition predicate for removing an element from a vector is !isEmpty(), whereas the condition expression for the while loop condition is isEmpty(). The correct way to invoke the wait() method when the vector is empty is shown below.
public void consumeElement() throws InterruptedException { synchronized (vector) {
while (vector.isEmpty()) { vector.wait();
}
// Consume when condition holds
}
}
The notification mechanism notifies the waiting thread and lets it check its condition predicate. The invocation of the notify() or notifyAll() methods in another thread cannot precisely determine which waiting thread is resumed. A condition predicate statement is provided so that only the correct thread will resume upon receiving the notification. A condition predicate also helps when a thread is required to block until a condition becomes true, such as reading data from an input stream before proceeding.
Safety and liveness are both concerns when using the wait/notify mechanism. Safety requires all objects to maintain consistent states in a multithreaded environment [Lea 2000a]. Liveness requires that every operation or method invocation execute to completion without interruption.
To guarantee liveness, the while loop condition must be tested before the wait() method is invoked. This is done in case another thread has already satisfied the condition predicate and sent a notification. Invoking the wait() method after the notification has been sent results in indefinite blocking.
To guarantee safety, the while loop condition must be tested even after the wait() method is invoked. While wait() is meant to block indefinitely until a notification is received, it must still be encased within a loop to prevent the following vulnerabilities [Bloch 2001]:
•thread in the middle - A third thread can acquire the lock on the shared object during the interval between a notification being sent and the receiving thread resuming execution. This thread can change the state of the object, leaving it inconsistent. This is a time-of-check-to- time-of-use (TOCTOU) condition.
•malicious notification - There is no guarantee that a random notification will not be received when the condition predicate is false. This means that the invocation of wait() may be nullified by the notification.
CMU/SEI-2010-TR-015 | 101
THI03-J
•misdelivered notification - Sometimes on receipt of a notifyAll() signal, an unrelated thread can start executing, and it is possible for its condition predicate to be true. Consequently, it may resume execution although it was required to remain dormant.
•spurious wake-ups - Certain JVM implementations are vulnerable to spurious wake-ups that result in waiting threads waking up even without a notification [Sun 2009b].
For these reasons, the condition predicate must be checked after the wait() method is invoked. A while loop is the best choice for checking the condition predicate before and after invoking wait().
Similarly, the await() method of the Condition interface must also be invoked inside a loop. According to the Java API [Sun 2009b], Interface Condition
When waiting upon a Condition, a “spurious wakeup” is permitted to occur, in general, as a concession to the underlying platform semantics. This has little practical impact on most application programs as a Condition should always be waited upon in a loop, testing the state predicate that is being waited for. An implementation is free to remove the possibility of spurious wakeups but it is recommended that applications programmers always assume that they can occur and so always wait in a loop.
New code should use the java.util.concurrent concurrency utilities instead of the wait/notify mechanism. However, legacy code may depend on the wait/notify mechanism.
4.4.1Noncompliant Code Example
This noncompliant code example invokes the wait() method inside a traditional if block and fails to check the post-condition after the notification is received. If the notification is accidental or malicious, the thread can wake up prematurely.
synchronized (object) {
if (<condition does not hold>) { object.wait();
}
// Proceed when condition holds
}
CMU/SEI-2010-TR-015 | 102